# DF-3723 — ixgbe_checksum_ptr_x550 caller-buffer path: bounds checks ignore the `ptr` base offset (+ two off-by-ones) → OOB read past caller's `u16 buffer[]`

**File:** `sys/dev/netif/ix/ixgbe_x550.c` (lines 3338–3397, 3407–3433)
**Severity:** Low (latent — no in-tree caller passes a non-NULL buffer) **Confidence:** certain (source-proven + on-guest bound-math demo)

## Build / Run (bound-math demo)

The guest has no X550 NIC, so the HAL cannot run on hardware. The demo
replicates the exact shipped guards and loop and shows a valid-looking call
reading past the end of the caller's buffer; it also runs the fixed guards
(the exact code in `fix.diff`) and shows them rejecting the same call.

```
# on the audit host:
ssh -F dfbsd-qemu/config dfbsd 'cat > /tmp/chksum_bounds_demo.c' < chksum_bounds_demo.c
dfbsd-qemu/vm.sh run_root 'cc -O2 -o /tmp/chksum_bounds_demo /tmp/chksum_bounds_demo.c && /tmp/chksum_bounds_demo'
```

Expected (observed, see `run.log`):

```
SHIPPED: OOB READ — first out-of-bounds word index = 100 (buffer holds 0..99); reads run to buffer[90+50]=buffer[140]
FIXED:   rejected (ERR_PARAM) — OOB prevented
OFF-BY-ONE (buffer_size == ptr == 90): SHIPPED ACCEPTS and reads buffer[90] (reads length at buffer[90] — one word past end)
OFF-BY-ONE: FIXED rejects
```

## Fix compile-validation (see `fix_build.log`)

`fix.diff` was applied inside the guest's `/usr/src/sys/dev/netif/ix/` copy
(repo `sys/` is read-only and was never touched) and the if_ix module rebuilt
with the kernel warning set including `-Werror`:

```
cc ... -Werror ... -c /usr/src/sys/dev/netif/ix/ixgbe_x550.c
cc -Wl,--build-id=sha1 ... -r -o if_ix.ko ... ixgbe_x550.o     # make_rc=0
```

The patch was then reverted in the guest (md5 restored to baseline).

## Artifacts
- `chksum_bounds_demo.c` / `build.log` / `run.log` — on-guest bound-math demo
- `fix.diff` — 3-hunk guard fix, git-apply-able against `sys/dev/netif/ix/ixgbe_x550.c`
- `fix_build.log` — full module build with the fix applied (clean, `-Werror`)
- `env.txt` — guest uname + pciconf (no X550 present) + compiler version
- `VERDICT.md`, `manifest.json`, `verdict.json`